# Okta SSO authentication fails - Failed secondary authentication

**URL:** <https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754>\
**Category:** Pritunl VPN\
**Tags:** pritunl, pritunl-client\
**Created:** [January 29, 2024, 1:54pm UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754 "2024-01-29T13:54:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sk-gretar](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/s/9fc348/32.png) [@sk-gretar](https://forum.pritunl.com/u/sk-gretar)\
**Post date:** [January 29, 2024, 1:54pm UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754/1 "2024-01-29T13:54:34Z")

</div>

Greetings!

I’m working on setting up a Pritunl VPN with Single Sign-On using Okta. I’ve managed to set up all the SSO-related information and authentication is working fine on the web interface.  
When I try authenticating to a VPN server using SSO I get a `Failed to authenticate to <server>` error in the client and the following error in the VPN server logs:

```auto
ERROR User open ovpn failed "Failed secondary authentication"

```

This error also shows up in the Pritunl host logs:

```auto
[hostname][2024-01-29 14:13:34,801][WARNING] Okta user is not assigned to application
  username = "user@corporation.org"
  okta_app_id = "j234gkj3g24jkhgk2hg34jh"
  user_id = "b8v9cb8c9b89cvb89cvb"

```

It doesn’t matter what I select as the `Okta Second Factor`, authenticating doesn’t trigger a push to Fastpass or a prompt for a MFA code.

The authentication seems to work fine apart from that, it correctly opens up a browser where I authenticate to Okta and it shows me a `Successfully authenticated connection` message when I’ve authenticated.

I can get around the error in the logs and authenticate successfully if I edit the user and check the `Bypass Secondary Authentication` checkbox under the advanced settings. I however don’t want to do that for each user.

The client is the Pritunl client on macOS 14.3.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [January 29, 2024, 6:04pm UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754/2 "2024-01-29T18:04:15Z")

</div>

This is likely from setting the incorrect Okta App ID in the top right settings. Check the [**Okta single sign-on**](https://docs.pritunl.com/docs/okta) documentation. The option can be left blank to disable the check. This will cause only the status of the user to be checked, this will verify the user is not disabled or deleted in Okta.

---

<div class="post-metadata">

**Author:** ![sk-gretar](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/s/9fc348/32.png) [@sk-gretar](https://forum.pritunl.com/u/sk-gretar)\
**Post date:** [January 30, 2024, 10:30am UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754/3 "2024-01-30T10:30:45Z")

</div>

Thanks for the quick reply, it was indeed the Okta app ID. I updated it with the correct ID and it’s working fine now!

---

<div class="post-metadata">

**Author:** ![meoptimusprime](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/858c86/32.png) [@meoptimusprime](https://forum.pritunl.com/u/meoptimusprime)\
**Post date:** [February 21, 2024, 9:02am UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754/4 "2024-02-21T09:02:31Z")

</div>

I am also facing the same issue however the the option is blank in pritunl server.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [February 21, 2024, 4:46pm UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754/5 "2024-02-21T16:46:04Z")

</div>

It’s not possible to get the error `Okta user is not assigned to application` if the _Okta App ID_ is empty. [pritunl/pritunl/sso/okta.py at master · pritunl/pritunl · GitHub](https://github.com/pritunl/pritunl/blob/master/pritunl/sso/okta.py#L64)

---

<div class="post-metadata">

**Author:** ![meoptimusprime](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/858c86/32.png) [@meoptimusprime](https://forum.pritunl.com/u/meoptimusprime)\
**Post date:** [February 26, 2024, 1:57pm UTC](https://forum.pritunl.com/t/okta-sso-authentication-fails-failed-secondary-authentication/1754/6 "2024-02-26T13:57:13Z")

</div>

Okta App id is empty, also the user is assigned to the application in okta, once i disable secondary authentication, it works.